We are using the same confd (8.0.17.1) version for both amd64 and arm64. The amd64 binary depends on libcrypto.so.1.1, while the arm64 binary depends on libcrypto.so.1.0.0. Why do these binaries have different OpenSSL library requirements despite being the same release version?
Hello @ankitrathore
Interesting point. Both should point to the same libcrypto.
What is the output for the following command?
readelf -d ./lib/confd/lib/core/crypto/priv/lib/crypto.so | grep libcrypto
Regards,
João.
Below is the output from arm64:
]$ readelf -d crypto.so | grep libcrypto
0x0000000000000001 (NEEDED) Shared library: [libcrypto.so.1.0.0]
[ankit@config-service-0 lib64]$ ldd /confd8/confd/lib/confd/lib/core/crypto/priv/lib/crypto.so
/confd8/confd/lib/confd/lib/core/crypto/priv/lib/crypto.so: libcrypto.so.1.0.0: no version information available (required by /confd8/confd/lib/confd/lib/core/crypto/priv/lib/crypto.so)
linux-vdso.so.1 (0x0000ffffb1964000)
libcrypto.so.1.0.0 (0x0000ffffb16f7000)
libc.so.6 (0x0000ffffb1549000)
/lib/ld-linux-aarch64.so.1 (0x0000ffffb1920000)
[ankit@config-service-0 lib64]$
Below is the output from amd64:
[ankit@config-service-0 lib64]$ ldd /confd8/confd/lib/confd/lib/core/crypto/priv/lib/crypto.so
linux-vdso.so.1 (0x00007ffc20ff7000)
libcrypto.so.1.1 (0x00007f4382273000)
libc.so.6 (0x00007f438206a000)
libz.so.1 (0x00007f4382050000)
/lib64/ld-linux-x86-64.so.2 (0x00007f438277e000)
[ankit@config-service-0 lib64]$
Thanks for the input.
For both platforms, does the OS provides both libcrypto.so.1.0.0 and libcrypto.so.1.1? (/usr/lib)
One more question, I’m assuming that `crypto.so` is as-is from confd package. I meant without rebuilding it, right ?
Thanks.
Yes, crypto.so is being picked up as-is from the ConfD package. We have both libcrypto.so.1.0.0 and libcrypto.so.1.1 available on the system but its linking to libcrypto.so.1.0.0 as its shared . We also tried using a custom OpenSSL location by setting LD_LIBRARY_PATH, but the behavior remains the same.
LD_LIBRARY_PATH=/home/rathorean/openssl-1.1.1k-build/lib:$LD_LIBRARY_PATH
Could you please verify on your side using the ARM64 binaries and confirm which OpenSSL library version ConfD is linking against? Specifically, is it resolving to libcrypto.so.1.0.0 or libcrypto.so.1.1.1?
We suspect this might be the root cause of the issue. Since RHEL 9 and later deprecate legacy RSA algorithms and older OpenSSL dependencies, we are encountering SSL handshake failures when attempting to connect through CLI or NETCONF.
Could you please check and confirm your findings? Thanks.
So, here is my result:
joafreit@p1:~/old_confd/confd-8.0.17.1.linux.arm64$ readelf -d ./lib/confd/lib/core/crypto/priv/lib/crypto.so
Dynamic section at offset 0x173f0 contains 25 entries:
Tag Type Name/Value
0x0000000000000001 (NEEDED) Shared library: [libcrypto.so.1.0.0]
0x0000000000000001 (NEEDED) Shared library: [libc.so.6]
0x000000000000000c (INIT) 0x8fb0
0x000000000000000d (FINI) 0x15de4
0x0000000000000019 (INIT_ARRAY) 0x273d8
0x000000000000001b (INIT_ARRAYSZ) 8 (bytes)
0x000000000000001a (FINI_ARRAY) 0x273e0
0x000000000000001c (FINI_ARRAYSZ) 8 (bytes)
0x000000006ffffef5 (GNU_HASH) 0x180
0x0000000000000005 (STRTAB) 0x3320
0x0000000000000006 (SYMTAB) 0x710
0x000000000000000a (STRSZ) 7785 (bytes)
0x000000000000000b (SYMENT) 24 (bytes)
0x0000000000000003 (PLTGOT) 0x27878
0x0000000000000002 (PLTRELSZ) 7488 (bytes)
0x0000000000000014 (PLTREL) RELA
0x0000000000000017 (JMPREL) 0x7270
0x0000000000000007 (RELA) 0x5578
0x0000000000000008 (RELASZ) 7416 (bytes)
0x0000000000000009 (RELAENT) 24 (bytes)
0x000000006ffffffe (VERNEED) 0x5538
0x000000006fffffff (VERNEEDNUM) 2
0x000000006ffffff0 (VERSYM) 0x518a
0x000000006ffffff9 (RELACOUNT) 123
0x0000000000000000 (NULL) 0x0
[0.004s] --> [0]
joafreit@p1:~/old_confd/confd-8.0.17.1.linux.arm64$ cd ../confd-8.0.17.1.linux.x86_64
[0.001s] --> [0]
joafreit@p1:~/old_confd/confd-8.0.17.1.linux.x86_64$ readelf -d ./lib/confd/lib/core/crypto/priv/lib/crypto.so
Dynamic section at offset 0x19b60 contains 25 entries:
Tag Type Name/Value
0x0000000000000001 (NEEDED) Shared library: [libcrypto.so.1.1]
0x0000000000000001 (NEEDED) Shared library: [libc.so.6]
0x000000000000000c (INIT) 0x92f8
0x000000000000000d (FINI) 0x166c8
0x0000000000000019 (INIT_ARRAY) 0x219b48
0x000000000000001b (INIT_ARRAYSZ) 8 (bytes)
0x000000000000001a (FINI_ARRAY) 0x219b50
0x000000000000001c (FINI_ARRAYSZ) 8 (bytes)
0x000000006ffffef5 (GNU_HASH) 0x1f0
0x0000000000000005 (STRTAB) 0x3608
0x0000000000000006 (SYMTAB) 0x788
0x000000000000000a (STRSZ) 8206 (bytes)
0x000000000000000b (SYMENT) 24 (bytes)
0x0000000000000003 (PLTGOT) 0x21a000
0x0000000000000002 (PLTRELSZ) 6816 (bytes)
0x0000000000000014 (PLTREL) RELA
0x0000000000000017 (JMPREL) 0x7858
0x0000000000000007 (RELA) 0x5a58
0x0000000000000008 (RELASZ) 7680 (bytes)
0x0000000000000009 (RELAENT) 24 (bytes)
0x000000006ffffffe (VERNEED) 0x59f8
0x000000006fffffff (VERNEEDNUM) 2
0x000000006ffffff0 (VERSYM) 0x5616
0x000000006ffffff9 (RELACOUNT) 123
0x0000000000000000 (NULL) 0x0
I think both should use libcrypto.so.1.1. But, I don’t know if there any other technical motivation to no use the same version.
Thanks for the confirming @joao.freitas. Is there any workaround possible to make it work? we already tried recompiling the crypto.so with openssl-1.1 but it didn’t work.